CVE-2026-45125
Received Received - Intake

Email Header Injection in MyBB Forum Software

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-45125
EUVD
EUVD-2026-61011

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb to 1.8.40 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MyBB forum software versions before 1.8.40. It allows mail header injection through improper sanitization of sender names in the Email User feature. Attackers can inject arbitrary headers using CRLF sequences, potentially manipulating email routing or content.

Detection Guidance

Check MyBB version in your forum admin panel. If version is below 1.8.40, the system is vulnerable. Inspect email headers for injected fields or unusual Return-Path/Reply-To values.

Impact Analysis

An attacker could send emails from your forum with forged headers, potentially tricking recipients into disclosing sensitive information or bypassing security measures. This could damage your forum's reputation and trustworthiness.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or phishing attacks, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations and penalties if exploited.

Mitigation Strategies

Upgrade MyBB to version 1.8.40 or later immediately. Disable the Email User feature if not needed. Review and restrict cansendemail group permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart